Experimental implementation of non-Gaussian attacks 
on a continuous- variable quantum key distribution system 
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An intercept-resend attack on a continuous- variable quantum key distribution protocol is investi- 
gated experimentally. By varying the interception fraction, one can implement a family of attacks 
where the eavesdropper totally controls the channel parameters. In general, such attacks add excess 
noise in the channel, and may also result in non-Gaussian output distributions. We implement 
and characterize the measurements needed to detect these attacks, and evaluate experimentally the 
information rates available to the legitimate users and the eavesdropper. The results are consistent 
with the optimality of Gaussian attacks resulting from the security proofs. 
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Quantum key distribution (QKD) enables two distant 
parties - Alice and Bob - linked by a quantum channel 
and an authenticated classical channel to share a com- 
mon secret key that is unknown to a potential eaves- 
dropper Eve. For this purpose, Alice and Bob have to 
agree on a proper set of non-commuting quantum vari- 
ables, as well as a proper encoding of the key into these 
variables. Common QKD setups use so-called discrete 
variables (e.g. the polarization of a photon], thereby re- 
quiring single-photon sources or detectors 

In this Letter, we shall rather follow an alternative 
procedure, pioneered in which consists in encoding 

the key into continuous variables (CV). Specifically, we 
use a CVQKD protocol with coherent states intoroduced 
in [1] . The action of a possible eavesdropper then appears 
as added noise on the observed continuous data. More 
precisely, line losses correspond to a restricted class of 
attacks, often called beam-splitting attacks, which only 
add Gaussian "vacuum" noise. Other attacks typically 
add more noise, called "excess noise" , which may be non- 
Gaussian. It is generally crucial to show that Alice and 
Bob can measure these noises with the required accuracy 
in order to ensure the security of CV-QKD. 

In order to analyse these noises, we have explicitly im- 
plemented several non-trivial actions of the eavesdropper 
Eve, which are simple but general enough to include both 
Gaussian and non-Gaussian features. These attacks are 
implemented optically as partial intercept-resend (IR) 
operations, in which the signal beam is either measured 
and subsequently re-prepared, or is eavesdropped using a 
beam splitter (BS). These attacks enable Eve to control 
independently the two main channel parameters, namely 
the loss (BS part) and excess noise (IR part), simply 
by adjusting the intercepted fraction. They are therefore 
much more powerful than a simple BS attack correspond- 
ing to a pure line loss. We examine in detail how well 
Alice and Bob can detect them in real operating condi- 



tions. The experiment confirms and emphasizes that it 
is crucial to properly evaluate the channel excess noise 
in order to warrant the security of the present CV-QKD 
protocol 0, H, @| . In addition, we explicitly measure the 
information gained by Eve for a wide range of partial IR 
attacks, and check that it never exceeds the bound based 
on Gaussian attacks (with excess noise). This is in full 
agreement with the security proof given in [3] ■ 

Our CV-QKD protocol is based on coherent states and 
reverse reconciliation, as described in Q ■ Alice sends Bob 
a train of coherent states \x + ip) where the quadratures 
(x,p) are randomly chosen from a bivariate Gaussian dis- 
tribution with variance Va- Bob randomly measures ei- 
ther x or p, and publicly announces his choice. A binary 
secret key is then extracted from the correlated continu- 
ous data by using a sliced reconciliation algorithm [H, 0] . 
This protocol is well suited for practical QKD because it 
only requires conventional fast telecommunication com- 
ponents, such as InGaAs photodiodes or electro-optics 
modulators. A full QKD setup with a typical repeti- 
tion rate of 1 MHz can be assembled with off-the-shelves 
components [l(| ■ The security of the protocol is proven 
against a wide range of attacks, namely Gaussian individ- 
ual attacks 0], finite-size non-Gaussian attacks Q, and 



Gaussian collective attacks 11,1131. It will be sufficient 



for our needs here to focus on the proof of Q, which 
provides a simple analytical expression for the secret key 
rates against non-Gaussian attacks. 

General framework. The processing of a coherent 
state via a Gaussian quantum channel can be described 
as follows. Its amplitude is multiplied by VT, where 
T < 1 is the channel transmission, while its noise vari- 
ance is increased to (1 + Te)No at the output, where 
No stands for the shot-noise level and e is the so-called 
excess noise (referred to the input). Assuming that the 
limited efficiency r\ < 1 of the homodyne detector deteri- 
orates Bob's reception but does not contribute to Eve's 



2 



information (so-called "realistic mode" in 0, [H|), the 
information rates can be written as 
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In reverse reconciliation [J], the secret key rate is given 
by X = [3 Iab — I BE: where (3 is the efficiency of the 
reconciliation algorithm with respect to Shannon's limit. 
All the quantities appearing in these formulas are known 
or can be measured by Alice and Bob. In practice, Alice 
and Bob must carefully evaluate T and e in order to infer 
the optimal attack Eve can perform, and therefore to 
upper bound I be- This is done by statistical evaluation 
over a random subset of the raw data [ijj] . 

Non-Gaussian attacks. Let us consider a particular 
non-Gaussian attack, namely a partial intercept-resend 
(IR) attack: Eve detects and resends a fraction /i of the 
pulses, while she performs a standard beam-splitter (BS) 
attack on the remaining fraction (1 — /i). For the IR 
step, Eve performs a simultaneous measurement of both 
quadratures (Fig. Q}, and resends a coherent state dis- 
placed according to her measurement results. For the 
BS step, Eve is assumed to keep the tapped signal in 
a quantum memory and to measure it only after Bob 
has revealed his measurement basis. For given chan- 
nel parameters (T, e) , the optimal attack is known to be 
Gaussian Q. It can be achieved using an "entangling 
doner" which simply reduces to a BS attack if e = 0. 
If e 7^ 0, the partial IR attack that we consider here is 
not optimal, although it has several advantages for our 
demonstration purposes. First, it gives Eve a very sim- 
ple way to exploit the excess noise of the line in order to 
gain more information; second, it provides the opportu- 
nity to check explicitly the bound on Eve's information 
for non-Gaussian attacks, deduced from Alice and Bob's 
noise variance measurements as established in Q. 

Let us emphasize that for a full IR attack (fi= 1), one 
has e = 2. This corresponds to the "entanglement break- 
ing" limit in our protocol [l| , at the edge between the 
classical and quantum regimes. No entanglement can be 
transmitted through the quantum channel, and therefore 
no secret key can be extracted. For a lossy channel, this 
added noise gets attenuated, so the entanglement break- 
ing limit may become difficult for Bob to detect. Thus, 
as another challenge to our experimental implementation, 
it is interesting to check whether Bob can detect this IR 
attack and properly reject the transmitted key. 

Experimental setup. We have realized the IR attack 
using the device described Fig. [2j It is a coherent-state 
QKD setup, working at 1550 nm and exclusively assem- 
bled with fiber optics and fast telecom components. It 
displaces a train of pulsed coherent states within the 
complex plane, with arbitrary amplitude and phase, ran- 




FIG. 1: Intercept-resend attack. Alice prepares a random 
coherent state, and Bob chooses a random quadrature mea- 
surement with a random number generator (RNG). In be- 
tween, Eve makes an heterodyne measurement of each incom- 
ing quantum state, and displaces another generated coherent 
state according to her measurement result. 
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FIG. 2: Experimental setup. Alice generates modulated sig- 
nal pulses. Bob measures a random quadrature with a pulsed, 
shot noise limited homodyne detector. 



domly chosen from a two-dimensional Gaussian distribu- 
tion with variances Va = 36.6 No. The pulse width is 100 
ns. The signal is sent to Bob along with a strong phase 
reference - or local oscillator (LO), with 10 9 photons per 
pulse. Bob selects an arbitrary measurement phase with 
a phase modulator placed on the LO path. The selected 
quadrature is measured with an all-fiber shot noise lim- 
ited, time-resolved homodyne detector. A key transmis- 
sion is composed of independent blocks of 50000 pulses, 
sent at a rate of 500 kHz, among which 10000 test pulses 
with agreed amplitude and phase are used to synchro- 
nize Alice and Bob and to determine the relative phase 
between the signal and LO (see [lj| for more details). 
Knowing this relative phase, Bob is able to choose an ab- 
solute phase measurement, for example one of the field 
quadratures x and p, with a software control loop. 

Practical QKD requires that only a part of the dataset 
is revealed for channel parameters evaluation. This fi- 
nite set size introduces statistical fluctuations that can 
alter the excess noise estimate. Therefore, security mar- 
gins have to be considered when computing information 
rates. In all the experimental curves shown below, the 
number of sampling points for channel characterization 
has arbitrarily been chosen to be 5000 (i.e. 13% of the 
40000 available pulses) for illustration purpose, and may 
be optimized for each value of the channel transmission. 

Implementation of full IR attacks. To implement an 
IR attack as in Fig. [TJ one would need three homodyne 
detectors and two modulation setups. To avoid unneces- 



3 




0.2 0.4 0.6 0.8 1 
Channel transmission (T) 

FIG. 3: Variance of the noise measured by Bob that is pro- 
duced by a full IR attack (n = 1). We define the total 
added noise (referred to the input) as \ — Xo + e , with 
Xo ~ l/(r)T) — 1 denoting the loss- induced vacuum noise and 
e denoting the excess noise. The total added noise x (stars) is 
measured experimentally, while xo (crosses) is deduced from 
the measured transmission (T) and from Bob's homodyne ef- 
ficiency (j) — 0.6). Then e (plus) is obtained from their differ- 
ence. The uncertainties margins on e represent the standard 
deviation of statistical fluctuations when computing over a 
finite data subset (5000 points out of 40000). 



sary hardware duplication, this attack has been split in 
three phases, with the role of Eve being played either by 
Alice or by Bob. First, Alice sends coherent states, and 
Bob simulates Eve measuring the x quadrature of the in- 
coming states. Then, the same operation is repeated with 
a p measurement. To take into account Eve's beam split- 
ter shown in Fig.[TJ the variance measured by Eve (actu- 
ally Bob) is adjusted to be exactly half of Alice's output 
modulation. This calibration also virtually includes the 
losses within the homodyne detector into the beam split- 
ter, thus simulating a perfect heterodyne measurement. 
Both x and p measurement outputs are then communi- 
cated to Alice through a classical channel so that she 
can simulate Eve resending coherent states that are dis- 
placed accordingly. After this sequence, the correlations 
between Alice and Bob are measured in order to deter- 
mine the channel parameters. Since Alice and Eve drop 
the quadrature not measured by Bob, our two-step im- 
plementation of the interception is legitimate. 

The excess noise referred to the channel input is mea- 
sured by Bob for different channel transmissions, se- 
lected with an amplitude modulator. For a full IR at- 
tack (/x = 1), the excess noise is measured to be about 
0.1 Nq above the expected 2 No entanglement breaking 
bound (Fig. [3]). This is due to the various technical 
noises encountered throughout the IR process, which can 
be independently determined from the experimental data 
(mostly laser phase noise and modulation imperfections) . 
Since this technical noise is quite small, we also con- 
clude that the imperfections related to the method used 
to "simulate" Eve are negligible. 
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FIG. 4: Variance of the excess noise in a partial IR attack. 
Each point results from an average of the measured excess 
noise for different channel transmissions (see the t vs. T plot 
of Fig. [3j) . The solid line plots the expected excess noise due 
to an IR attack on a fraction fi of the pulses. Due to technical 
noise, the experimental data are above this line, typically less 
than 0.1 No (dashed line). 



Implementation of partial IR attacks. Because the 
full IR attack reaches the entanglement breaking limit, 
it is not the best for Eve to tap information from the 
quantum channel. As explained previously, a more sub- 
tle way for Eve to interact is to intercept and resend only 
a fraction fi of the pulses, and to implement a BS attack 
on the rest of the pulses. In this case, Eve can choose the 
amount of noise she wants to introduce independently of 
the channel transmission. This allows a complete channel 
parameter control, which is not achievable with a simple 
BS attack (e = 0) nor with an IR attack where the added 
noise is fixed for a given channel transmission. 

An important point is that the probability distribution 
of Bob's measurements becomes the weighted sum of two 
Gaussian distributions with different variances, namely 
TV A + N for the transmitted data (BS) and T(V A + 
2 No) + No for the resent data (IR), so the attack is not 
Gaussian any more. Figure [4] shows the measured excess 
noise for different interception fractions /i. Ideally, it is 
given by the weighted sum of the excess noises in the IR 
and BS cases, i.e., 6tot = M e iR + (1 — A*) £ bs = 2/i. 
In our experiment, we have to add the technical noise of 
variance ex = 0.1 No, which leads to e-roT = 2/i + £t, in 
good agreement with the experimental data. 

For such an attack, the achievable secret key rate is 
lower bounded by the information rate for an equiva- 
lent Gaussian attack characterized by the same variance 
and conditional variance of the data distribution [7| . The 
Gaussian mutual information rate I 9 AB between Alice and 
Bob can be derived from the noise variance measurements 
with a Gaussian channel model characterized by the same 
correlations. This can be compared with the actual mu- 
tual information rate I^ 9 B computed from the measured 
data distribution in presence of the partial IR attack. 
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FIG. 5: Mutual information rates for a non-Gaussian partial 
IR attack, for T = 0.1, 0.25 and 0.9, with V A = 36.6 N , 
r\ = 0.6 and a technical excess noise of 0.1 No. The mutual 
information I be is plotted for a Gaussian model with equiv- 
alent excess noise (solid lines), as well as for a BS attack 
(dotted lines), and for a partial IR attack (dashed lines). It 
is compared with the Gaussian mutual information Iab- As 
expected, the IR attack enables to exploit the excess noise, 
giving Eve extra information above the BS attack. We show 
statistical fluctuations (±1 standard deviation) corresponding 
to a data subset of 5000 points per block, as on Fig. [3] 



even if Eve does not implement the strongest attack. On 
Fig. [5] one can actually read the tolerable excess noise for 
a given channel transmission T, at the crossing point be- 
tween Iab and I be-, confirming that Alice and Bob are 
on the "safe side" when using the Gaussian bound 0] • 

In conclusion, we have implemented a family of quan- 
tum attacks, namely partial intercept-resend attacks, 
which allow Eve to exploit the excess noise and are thus 
more general than simple "beam-splitting attacks" as 
considered so far. Our experiment confirms that such 
attacks can be successfully detected and eliminated by 
accurately monitoring the variances of all ( "vacuum" and 
"excess") noises of the channel. Therefore, the present 
"real-case study" provides both a test and an illustra- 
tion of the working principles of experimental CV-QKD. 
It is also particularly important in view of the recent 
proof lj,ll5( that the optimal collective attack for a given 
noise variance is Gaussian, just as for individual attacks. 
Considering that our family of attacks spans all possible 
relevant transmissions and noise variances of the channel, 
the security of our Gaussian-modulated protocol remains 
warranted under very general conditions. 
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We find that the Gaussian mutual information I AB is 
lower than the actual mutual information Ij? B , with a 
very small gap between them (< 0.8% for modulation of 
Va = 36.6 jVo) for any T and e. Therefore, only the curve 
I 9 AB (noted Iab ) has been represented on Fig. [5] 

On Eve's side, Fig. [5] compares Iab with three pos- 
sible values of I be- The dotted line (I B § ) * s obtained 
from a BS attack for the given transmission. With this 
attack, Eve only makes use of the channel losses, as if 
she was not able to exploit the excess noise. The dashed 
line (I B a B ttal IR ) is obtained when, in addition to the BS 
attack, Eve exploits the excess noise for implementing a 
partial IR attack. This information therefore reads 
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The experimental points shown over the dashed line are 
obtained from this formula, using the measured informa- 
tion acquired by Eve from the IR part of the attack /gg, 
and the evaluated information from the BS attack (dot- 
ted line). The solid line (I BE ) is the optimal Gaussian 
attack where Eve exploits the excess noise for implement- 
ing an entangling doner attack. The experimental points 
shown over this solid line are the bounds on Ib e deduced 
from the measured line parameters, according to eq. [5] 
These curves show the crucial role of the excess noise, 
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